Unauthorized Plugin Installation Vulnerability in CleanTalk for WordPress

What is CVE-2024-10542?

CVE-2024-10542 is a critical vulnerability found in the CleanTalk plugin for WordPress, which offers spam protection and firewall functionalities. This vulnerability results from an authorization bypass through reverse DNS spoofing, allowing unauthorized attackers to install and activate arbitrary plugins. The implications of this flaw are severe, as it can potentially enable attackers to execute remote code on compromised systems, significantly increasing the risk of data breaches and system manipulation for organizations relying on this plugin for secure operations.

Technical Details

The vulnerability resides specifically in the checkWithoutToken function within the CleanTalk plugin, affecting all versions up to 6.43.2. The flaw enables attackers to exploit the lack of proper authorization checks, making it possible for them to inject malicious plugins into WordPress sites without authentication. This arbitrary plugin installation can lead to additional risks if the malicious plugins installed on the server have their own vulnerabilities, thereby creating pathways for further exploitation.

Potential impact of CVE-2024-10542

1. Remote Code Execution: Attackers could use the unauthorized installation of plugins to execute arbitrary code on the affected systems, effectively compromising system integrity and confidentiality.

2. Unauthorized Access to Sensitive Information: Exploiting this vulnerability could allow attackers to access and manipulate sensitive user data stored within WordPress, leading to potential data breaches.

3. Increased Malware Propagation: By facilitating the installation of malicious plugins, this vulnerability opens avenues for malware distribution, which could further infect the organization’s network or spread to other connected systems.

References